openid-connect-url-https-only

Flags an OpenID Connect scheme whose openIdConnectUrl is not an absolute HTTPS URL.

Attribute	Value
Category	Security
Maturity	Platinum
Lenient	Warning
Recommended–Complete	Error

See it fail

oidc:
  type: openIdConnect
  openIdConnectUrl: http://id.example.org/.well-known/openid-configuration

Fix it

Use the provider's HTTPS discovery URL.

Nearby: oauth-authorization-url-https-only, hosts-https-only.